- When it comes to rogue access points
what sort of methods can we employ to protect ourselves?
Let's say we're on the enterprise side
of things and we need to protect our enterprise network
from rogue access points.
It's not necessarily gonna be that person
wearing the orange vest coming
on site and installing a rogue access point.
Internal employees can do this stuff as well.
So what can you do to protect yourself?
Proactively scan for access points that are connected
to your network and or in your space.
So broadcasting wireless or plugged in.
Don't forget that walls don't always matter
when it comes to wireless networks,
you know, unless you
have some radiation shielding, you know, you're
in a Faraday cage in your office.
There's a good chance
your wireless network is accessible
beyond the wall that you might think it is.
If you're in a multi-story building,
don't forget you could have a neighbor upstairs
that has a different wireless network
not necessarily plugged into your network,
but it's an access point
that is accessible from your space.
And that's not a rogue by the way.
Rogue is connected to your network.
Check the CAM tables for OUIs
that are associated with wifi access point vendors.
We have this URL here, wireshark.org OUI lookup.
You can go in there,
take those first three bites
drop it into this form
and see who the maker of that particular product is.
Enterprise solutions that do rogue detection capabilities.
There are products on the market
that will proactively look at CAM tables,
compare it to OUI vendors or vendors associated.
OUI is associated with vendors.
And let you know that, you know, you have
a rogue AP on your network.
If you do find one,
shut it down
because you cannot enforce security
on an access point that you do not control.
And then finally consider the use of wireless intrusion
detection and prevention.
Some best practices for wireless.
Change SSID from the default.
And remember that SSIDs are not passwords.
If you are using
a SOHO type wireless access point,
change the default username and password
for that router administration interface.
Remember that once I crack the pre-shared key
and I can join your network.
And then I surf to my default gateway
if it's a SOHO type access point,
I'm gonna know the vendor
of that product,
'cause it's gonna be prominently displayed
on whatever that landing page is to log in
to the administration portal.
Once I know the vendor,
I can go look up the default username and password.
And if you haven't changed it, I can log in and actually
kick you off your own network.
And disable the broadcasting of SSIDs.
It's a recommended best practice,
however, it's not going to protect you
from anything, that SSID can still be derived.
And finally disable remote administration
from the quote unquote land side of the,
and this is again for Soho type devices,
from the WAN side of the device.
Whatever that upstream interface is,
consider disabling administration
on that particular interface.
Filter MAC addresses
if administratively feasible.
I mentioned this in a previous lesson,
actually doing static MACs on switchports
in any scale of environment
is administratively intense.
Doing it at your house, easy to do, you know
your devices and your network
and it's, you know can be a little fun to say
that, you know, you can't connect to my network.
Regardless, doing this
in a enterprise environment, very difficult to do.
However, those switchport security features we talked about
in previous lesson could be employed here.
Wherein you allow
and learn the first MAC address
that connects, and then you don't allow it
to learn new MAC addresses.
When it comes to encryption
on your wireless networks, use WPA3 or WPA2.
If three is not available, disabled WEP entirely.
Do not put identifying information in your SSID.
It should be some random word that has nothing to do
with your company or your company name.
Use firewalls and intrusion detection devices.
This is just, you know,
classic perimeter edge security stuff.
Consider using higher level encryption.
So, once you've joined the network
there is some level of encryption there,
from your device to the access point.
The data that's inside that connection,
you could consider, you know
transport layer, security, IPsec, et cetera,
for encryption of the actual data
within that wireless connection.
Wireless IDs again, and intrusion prevention.
There are two products we'll touch on here,
one is from Cisco and one is from Aruba.
So the vendors of enterprise access points
also offer wireless intrusion prevention systems.
Cisco's adaptive wIPS is one such example.
And then Aruba has RFProtect Wireless Intrusion Protection,
with various licensing options available to you.
So these are enterprise access point vendors.
Oftentimes with enterprise access points
the inside wired interface
of that access point is simply a bridge
from the wireless network to the local area network.
In some cases, the data will be tunneled back
to a central point through something
like LWAPP in the Cisco realm.
And with these enterprise grade solutions
they offer solutions such
as this for wireless intrusion protection
and or prevention and or detection.